Background

Multiple vulnerabilities have recently been identified in the managed file transfer (MFT) software MOVEit developed by Ipswitch, Inc. and produced by Progress Software. These include CVE-2023-34362 [1], CVE-2023-35036 [2] and CVE-2023-35708 [3]. These vulnerabilities allow adversaries to gain unauthorized access and escalate privileges in the environment.

MOVEit is a popular tool that is used by thousands of organizations around the world. These include organizations in the public, private, and government sectors. The transfer software can be deployed as on-prem, in the MOVEit Cloud, or on any Microsoft Azure server. Due to the nature of handling potentially sensitive information, MOVEit is a lucrative target from a threat actor’s perspective, granting threat actors the ability to add and remove database content, execute arbitrary code, and steal sensitive information.

What do we know about the exploits?

While this story is still actively playing out and we will know the final count only in the coming weeks, here’s what we know about it thus far. 

The CL0p ransomware gang has been actively exploiting this vulnerability and has claimed to compromise over dozens of organizations across different industries and regions. These include oil & gas, news & media, healthcare, financial services, state and federal governments, and more. Anomali’s own assessment has shown that there are thousands of externally exposed MOVEit instances that could potentially be exploited. 

Additional public research has revealed that this vulnerability may have been actively exploited even since 2021 [4]. More recently, organizations have also released proof of concept (PoC) exploit code for this vulnerability [5], making it likely that other attackers could exploit unpatched systems.Anomali MOVEit Vulnerability Dashboard

The Anomali Threat Research team has additionally researched and documented additional details on this vulnerability via Thre ..

Support the originator by clicking the read the rest link below.